Omron
Products by Omron Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2024 there have been 2 vulnerabilities in Omron with an average score of 7.8 out of ten. Last year Omron had 8 security vulnerabilities published. Right now, Omron is on track to have less security vulnerabilities in 2024 than it did last year. However, the average CVE base score of the vulnerabilities in 2024 is greater by 0.29.
Year | Vulnerabilities | Average Score |
---|---|---|
2024 | 2 | 7.80 |
2023 | 8 | 7.51 |
2022 | 21 | 8.10 |
2021 | 5 | 7.94 |
2020 | 0 | 0.00 |
2019 | 16 | 7.78 |
2018 | 16 | 6.43 |
It may take a day or so for new Omron vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Omron Security Vulnerabilities
Project files may contain malicious contents which the software will use to create files on the filesystem
CVE-2022-45792
7.8 - High
- January 22, 2024
Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user.
Directory traversal
Sysmac Studio installs executables in a directory with poor permissions
CVE-2022-45793
7.8 - High
- January 10, 2024
Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.
Incorrect Default Permissions
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier
CVE-2023-22277
7.8 - High
- August 03, 2023
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22317 and CVE-2023-22314.
Dangling pointer
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier
CVE-2023-22314
7.8 - High
- August 03, 2023
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22317.
Dangling pointer
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier
CVE-2023-22317
7.8 - High
- August 03, 2023
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22314.
Dangling pointer
Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier
CVE-2023-38747
7.8 - High
- August 03, 2023
Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
Memory Corruption
Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier
CVE-2023-38748
7.8 - High
- August 03, 2023
Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
Dangling pointer
Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier
CVE-2023-38746
7.8 - High
- August 03, 2023
Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
Out-of-bounds Read
Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions
CVE-2023-27385
7.8 - High
- May 10, 2023
Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions. By having a user open a specially crafted SDD file, arbitrary code may be executed and/or information may be disclosed.
Memory Corruption
Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier
CVE-2023-22322
5.5 - Medium
- January 30, 2023
Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Motion Pro is installed may be disclosed.
XXE
Use after free vulnerability in CX-Drive V3.00 and earlier
CVE-2022-46282
7.8 - High
- December 21, 2022
Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a specially crafted file,
Dangling pointer
Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier
CVE-2022-43508
7.8 - High
- December 07, 2022
Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
Dangling pointer
Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier
CVE-2022-43509
7.8 - High
- December 07, 2022
Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
Memory Corruption
Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier
CVE-2022-43667
7.8 - High
- December 07, 2022
Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
Memory Corruption
OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may
CVE-2022-3398
9.8 - Critical
- October 06, 2022
OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.
Memory Corruption
OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may
CVE-2022-3397
9.8 - Critical
- October 06, 2022
OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.
Memory Corruption
OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may
CVE-2022-3396
9.8 - Critical
- October 06, 2022
OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.
Memory Corruption
Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution.
CVE-2022-2979
7.8 - High
- September 12, 2022
Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution.
Dangling pointer
Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords
CVE-2022-31204
7.5 - High
- July 26, 2022
Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.
Cleartext Transmission of Sensitive Information
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may
CVE-2022-33208
8.1 - High
- July 04, 2022
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who can analyze the communication between the affected controller and automation software 'Sysmac Studio' and/or a Programmable Terminal (PT) to access the controller.
Authentication Bypass by Capture-replay
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may
CVE-2022-34151
8.1 - High
- July 04, 2022
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
Use of Hard-coded Credentials
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, which may
CVE-2022-26417
7.8 - High
- April 01, 2022
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, which may allow an attacker to execute arbitrary code.
Dangling pointer
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may
CVE-2022-26419
7.8 - High
- April 01, 2022
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may allow an attacker to locally execute arbitrary code.
Memory Corruption
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may
CVE-2022-26022
7.8 - High
- April 01, 2022
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may allow an attacker to execute arbitrary code.
Memory Corruption
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may
CVE-2022-25959
7.8 - High
- April 01, 2022
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an attacker to execute arbitrary code.
Memory Corruption
Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite
CVE-2022-25230
7.8 - High
- March 10, 2022
Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25325.
Dangling pointer
Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite
CVE-2022-25234
7.8 - High
- March 10, 2022
Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-21124.
Memory Corruption
Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite
CVE-2022-25325
7.8 - High
- March 10, 2022
Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25230.
Dangling pointer
Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite
CVE-2022-21124
7.8 - High
- March 10, 2022
Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25234.
Memory Corruption
Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite
CVE-2022-21219
7.8 - High
- March 10, 2022
Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
Out-of-bounds Read
Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may
CVE-2022-21137
7.8 - High
- January 14, 2022
Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to execute arbitrary code.
Memory Corruption
Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16
CVE-2021-20836
6.5 - Medium
- October 19, 2021
Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16 allows an attacker with administrative privileges to cause information disclosure and/or arbitrary code execution by opening a specially crafted SCS project files.
Out-of-bounds Read
Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, which may
CVE-2021-27413
7.8 - High
- May 13, 2021
Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
Memory Corruption
The Omron CX-One Version 4.60 and prior is vulnerable to a stack-based buffer overflow, which may
CVE-2020-27261
8.8 - High
- February 09, 2021
The Omron CX-One Version 4.60 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.
Memory Corruption
The Omron CX-One Version 4.60 and prior may
CVE-2020-27259
8.8 - High
- February 09, 2021
The Omron CX-One Version 4.60 and prior may allow an attacker to supply a pointer to arbitrary memory locations, which may allow an attacker to remotely execute arbitrary code.
This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data
CVE-2020-27257
7.8 - High
- February 09, 2021
This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type-confusion condition in the Omron CX-One Version 4.60 and prior devices.
Object Type Confusion
Omrons CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.
CVE-2019-18269
9.8 - Critical
- December 16, 2019
Omrons CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.
In Omron PLC CS series
CVE-2019-18261
9.8 - Critical
- December 16, 2019
In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
Improper Restriction of Excessive Authentication Attempts
In Omron PLC CJ series
CVE-2019-18259
9.8 - Critical
- December 16, 2019
In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands.
Authentication Bypass by Spoofing
In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests
CVE-2019-13533
8.1 - High
- December 16, 2019
In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could result in the opening and closing of industrial valves.
Authentication Bypass by Capture-replay
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS
CVE-2019-18251
8.8 - High
- November 26, 2019
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of Teamviewer is vulnerable to an obsolete function vulnerability requiring user interaction to exploit.
The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path
CVE-2019-10971
7.8 - High
- June 12, 2019
The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories.
Untrusted Path
When processing project files
CVE-2019-6556
6.6 - Medium
- April 10, 2019
When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
Dangling pointer
PowerAct Pro Master Agent for Windows Version 5.13 and earlier
CVE-2018-16207
6.5 - Medium
- March 27, 2019
PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or edit unauthorized files via unspecified vectors.
When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attacker
CVE-2018-19020
5 - Medium
- February 12, 2019
When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attacker can force the application to read a value outside of an array.
Out-of-bounds Read
An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing project files
CVE-2018-19018
7.3 - High
- February 12, 2019
An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing project files. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
Access of Uninitialized Pointer
Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when processing project files
CVE-2018-19027
7.8 - High
- January 30, 2019
Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when processing project files. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
Incorrect Type Conversion or Cast
An attacker could inject commands to launch programs and create
CVE-2018-19015
7.3 - High
- January 28, 2019
An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file. An attacker could exploit this to execute code under the privileges of the application.
Shell injection
A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior)
CVE-2018-19019
7.3 - High
- January 22, 2019
A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
Incorrect Type Conversion or Cast
Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior)
CVE-2018-19017
8.8 - High
- January 22, 2019
Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior). When processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
Dangling pointer
An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file.
CVE-2018-19013
5 - Medium
- January 22, 2019
An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file.
Command Injection
CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file
CVE-2018-19011
8.8 - High
- January 22, 2019
CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. An attacker could exploit this to execute code under the privileges of the application.
Code Injection
Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior)
CVE-2018-18993
7.8 - High
- December 04, 2018
Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior). When processing project files, the application allows input data to exceed the buffer. An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the application.
Memory Corruption
In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior)
CVE-2018-18989
7.8 - High
- December 04, 2018
In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior), when processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
Dangling pointer
A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may
CVE-2018-17913
7.8 - High
- November 05, 2018
A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an attacker to execute code in the context of the application.
Incorrect Type Conversion or Cast
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed memory, which may
CVE-2018-17909
7.8 - High
- November 05, 2018
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed memory, which may allow an attacker to execute code under the context of the application.
Dangling pointer
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker
CVE-2018-17907
3.3 - Low
- November 05, 2018
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker can force the application to read a value outside of an array.
Information Disclosure
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte
CVE-2018-17905
7.8 - High
- November 05, 2018
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, memory corruption may occur within a specific object.
Buffer Overflow
Parsing malformed project files in Omron CX-One versions 4.42 and prior
CVE-2018-8834
7.8 - High
- April 17, 2018
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may cause a heap-based buffer overflow.
Buffer Overflow
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may
CVE-2018-7530
7.8 - High
- April 17, 2018
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may allow the pointer to call an incorrect object resulting in an access of resource using incompatible type condition.
Range Error
Parsing malformed project files in Omron CX-One versions 4.42 and prior
CVE-2018-7514
7.8 - High
- April 17, 2018
Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may cause a stack-based buffer overflow.
Buffer Overflow
In Omron CX-Supervisor Versions 3.30 and prior
CVE-2018-7513
5.3 - Medium
- March 21, 2018
In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a stack-based buffer overflow.
Buffer Overflow
In Omron CX-Supervisor Versions 3.30 and prior
CVE-2018-7525
5.3 - Medium
- March 21, 2018
In Omron CX-Supervisor Versions 3.30 and prior, processing a malformed packet by a certain executable may cause an untrusted pointer dereference vulnerability.
NULL Pointer Dereference
In Omron CX-Supervisor Versions 3.30 and prior
CVE-2018-7523
5.3 - Medium
- March 21, 2018
In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a double free vulnerability.
Double-free
In Omron CX-Supervisor Versions 3.30 and prior, use after free vulnerabilities
CVE-2018-7521
5.3 - Medium
- March 21, 2018
In Omron CX-Supervisor Versions 3.30 and prior, use after free vulnerabilities can be exploited when CX Supervisor parses a specially crafted project file.
Dangling pointer
In Omron CX-Supervisor Versions 3.30 and prior
CVE-2018-7519
5.3 - Medium
- March 21, 2018
In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a heap-based buffer overflow.
Buffer Overflow
In Omron CX-Supervisor Versions 3.30 and prior
CVE-2018-7517
5.3 - Medium
- March 21, 2018
In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause an out of bounds vulnerability.
Memory Corruption
In Omron CX-Supervisor Versions 3.30 and prior, access of uninitialized pointer vulnerabilities
CVE-2018-7515
5.3 - Medium
- March 21, 2018
In Omron CX-Supervisor Versions 3.30 and prior, access of uninitialized pointer vulnerabilities can be exploited when CX Supervisor indirectly calls an initialized pointer when parsing malformed packets.
NULL Pointer Dereference